Codeigniter security - mysql database

Question

I'm in the final stages of implementing a codeigniter site which requires a really simple login system: one user and one password, to protect the admin area.

I think I will be using one of the many CI authentication libraries, which should allow me to ensure that people can't read from the database without being logged in as admin(I hope).

Are there any glaring holes in a set up like this? Should I take further measures beyond using of a lib like this to ensure the security of the data in the mySQL database? It will be hosted on a shared server meaning little or no server config will be possible.

Answer 1

If it is on an apache server, then I would consider just setting up an htpasswd protected directory. Read more about it here.

Answer 2

I would create simple form-based authentication, and use a strong password.

HTTP authentication has too many problems IMHO:

• Easier to brute force hack.
• Anyone who sniffs the request can determine the username and password being used, but they don't even need to; they can just use an identical HTTP themselves.
• Once that dialog pops up, it's difficult to dismiss, which can be irritating.
• Many browsers will ask twice for a password before letting you in.
• It's difficult to logout or change users, you usually have to quit the browser.
• Easy to forget that you've let the browser save your credentials, which is another potential security risk.

Answer 3

I have used in the past (with excellent results) DX Auth 1.0.6.

You can find it at http://codeigniter.com/forums/viewthread/98465/

Answer 4

There is a long discussion about the authentication systems available here: http://stackoverflow.com/questions/346980/what-code-igniter-authentication-library-is-best

The latest version of Redux seems to be the favourite.

http://code.google.com/p/reduxauth/